Overview
- Security teams confirmed an OS command-injection bug, tracked as CVE-2026-106931, in SiteGuard Server Edition’s statistics feature that can execute OS commands as root or SYSTEM.
- The vulnerability affects SiteGuard Server Edition versions 2.20 and later up to but not including 8.00 Update 5 on Apache, Nginx, and IIS and up to 7.00 Update 6 on FreeBSD when the statistics feature is enabled.
- SiteGuard and JPCERT/CC rate the flaw critical and say it is being actively exploited, with public advisories and coverage appearing between October 14th and October 19th.
- SiteGuard issued upgrades and replacement-file patches for installs that cannot upgrade and warned that applying fixes will overwrite the same statistics files attackers may have altered, so administrators should download the web management “Diagnostic information” bundle and keep it off-box first.
- The flaw raises special concern because a WAF runs on the web host as a chokepoint, SiteGuard reports a large installed base (vendor: ~1.5 million sites; WordPress telemetry: ~500,000 active installs), and neither the attacker identities nor the scale and full impact of compromises are publicly known yet.